feat(control-plane): real X.509 agent leaf issuance (closes enrollment↔mTLS gap)

- ca/issue.ts: real X.509 v3 Ed25519 leaf with SPIFFE URI SAN, signed by the
  intermediate; SAN built via relay-auth spiffeIdFor so it can't drift
- ca/csr.ts: parse real PKCS#10 (agent's PEM) + async PoP verify; decodeCsrWire
  accepts PEM or base64(DER)
- main.ts/env.ts: real issuer when CA_INTERMEDIATE_KEY_PATH present, else dev fallback
- interop.test.ts: oracle proving relay-auth verifyAgentCert accepts the leaf (6 tests)
- deps: @peculiar/x509, reflect-metadata

control-plane/test/ca.test.ts

@@ -35,7 +35,7 @@ describe('T8 signHostLeaf — INV14 registry-gated + CSR PoP', () => {
     const forged = new Uint8Array(96)
     forged.set(publicKeyRaw, 0)
     forged.set(randomBytes(64), 32)
-    expect(verifyCsrPoP(forged).ok).toBe(false)
+    expect((await verifyCsrPoP(forged)).ok).toBe(false)
     await expect(signer.signHostLeaf(host.hostId, publicKeyRaw, forged)).rejects.toBeInstanceOf(LeafSignError)
     expect(signSpy).not.toHaveBeenCalled()
   })